Attestation format
Last updated
Last updated
SALT follows the in-toto Attestation Framework (IAF). The IAF provides a specification for generating verifiable claims about any aspect of how a piece of software is produced. Consumers or users of software can then validate the origins of the software, and establish trust in its supply chain, using in-toto attestations.
Attestations in the IAF are serialized as JSON.
The core of the IAF is the specification for in-toto attestation layers:
Envelope: Handles authentication and serialization.
Statement: Binds the attestation to a particular subject and unambiguously identifies the types of the predicate.
Predicate: Contains arbitrary metadata about a subject artifact, with a type-specific schema.
Bundle: Defines a method of grouping multiple attestations together.
In short,
Envelope is a signed attestation, conveying a Statement as payload (encoded in base64) and a Signature.
Envelopes typically have one signature but may have multiple.
A media type of application/vnd.in-toto.<predicate>+dss is assigned for envelopes.
A Statement binds a Subject and a Predicate, with a predicateType field that unambiguously identifies the type of the predicate via a type URI.
Subject is the set of software artifacts that the attestation applies to. Each software artifact is represented by ResourceDescriptor.
Predicate is the innermost layer of the attestation, containing arbitrary data about the Statement’s Subject.
The framework specifies the format and semantics for some common fields.
The following attestation predicates are supported:
https://slsa.dev/provenance/v1
An attestation that a particular build platform produced a set of software artifacts through execution of the buildDefinition, aligned with modern real-time platforms.
https://in-toto.io/attestation/link/v0.3
Every link attestation corresponds to the execution of one step in the software supply chain. The subject field in Statement corresponds to the products of the operation, while materials field in LinkPredicate indicates the inputs to the step.
https://cyclonedx.org/bom
Software Bill of Materials type following the CycloneDX standard.
https://in-toto.io/attestation/scai/attribute-report/v0.2
Capturing functional attribute and integrity information about software artifacts and their supply chain. SCAI data can be associated with executable binaries, linked libraries, software packages, container images,software toolchains, and compute environments.
https://in-toto.io/attestation/vulns/v0.1
Holds a vulnerabilities report from security tools, with info about the scanner used, how it was invoked, the vulnerabilities found with their severity scores, the vulnerability databases used, and when the scan was performed.
https://slsa.dev/verification_summary/v1
Verification summary attestations communicate that an artifact has been verified at a specific SLSA level and details about that verification.
https://in-toto.io/attestation/test-result/v0.1
Express the result of running tests in software supply chains.
https://in-toto.io/attestation/runtime-trace/v0.1
Describe system events that were part of some software supply chain step, for example, the build process of an artifact.
In addition, Xygeni adds the following predicates:
Collection
xygeni.io/attestations/collection-predicates/v1
A collection of predicates, allowing composition of multiple predicates for software subjects in a single in-toto Statement.
Command Run
xygeni.io/attestations/command-run/v1
Models a command execution captured with salt attestation run. Results from the command execution are captured, possibly linking the input and output of command.
Environment
xygeni.io/attestations/environment/v1
Models the system environment where the build/deploy is running. Computed by the environment attestor in the salt attestation init command.
Git
xygeni.io/attestations/git/v1
Information about git repository. Includes the last commit (sha1 hash, author and committer, message, commit signature if any), its parents, the git treeHash, and git refs pointing at it
Materials
xygeni.io/attestations/materials/v1
Information about materials (input resources) that were registered as relevant for the pipeline. Created at attestation commit for materials added in the add / commit commands.
Products
xygeni.io/attestations/products/v1
Contains a set of products (typically, by-products) that were generated at a certain step in a pipeline.
